Monitoring • Clarification needed - Hyper-V-Monitoring using WMI

Hello,

we are dealing with Event ID 4625 on the Hyper-V-servers because of limitations of WMI queries and local users, which results in a "Bad Hyper-V username logon attempt Error for Hyper-V Host XYZ" alarm.

• Disabling a usefull monitoring alarm is not an option.

• Spreading local backup system administrative users credentials to target domain systems the prevent the logon error is obviously violating security policies.

We do not know, how VeeamOne currently connects to the target machine (WMIC, Remote Powershell, ...) and we also do not know, if only WMIC or also Get-CIMInstance causes the same error message.

As a followup to our current support case (#07812527) and since Microsoft has announced depreciation of WMIC, we would consider the R&D team to think about moving from WMIC to Powershell, when it comes to monitoring Hyper-V hosts & guests (in case WMIC is currently used to gather information from the remote machine).

Kind Regards
guarana

Statistics: Posted by guarana — Sep 08, 2025 8:30 am

---